https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38382 Nick Clemens (kidclamp) <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Need a fresh connection |Need a fresh connection |when CSRF has expired |when CSRF has expired for | |connexion daemon -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38382 --- Comment #1 from Nick Clemens (kidclamp) <nick@bywatersolutions.com> --- Created attachment 174096 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=174096&action=edit Bug 38382: Fresh connection when connexion CSRF token expires This patch simply generates a new user agent when reauthenticating when the CSRF token for the session has expired. To test: 1 - Edit Koha/Token.pm, line 275 from: { MaxAge => $params->{MaxAge} // ( CSRF_EXPIRY_HOURS * 3600 ) }, to: { MaxAge => $params->{MaxAge} // ( CSRF_EXPIRY_HOURS ) }, 2 - This will make your CSRF tokens expire after 8 seconds 3 - vim /etc/koha/sites/kohadev/connexion.cnf 4 - Set content: host: port: 8888 koha:http://localhost:8081 log:/var/log/koha/kohadev/connexion.log match:ISBN user:kohauser password:kohapass overlay_action:replace nomatch_action:create_new item_action:always_add import_mode:direct framework:BKS overlay_framework: debug:1 5 - Save the sample file from this bug into your kohaclone (or copy and paste into a file your koha test site can reach) 6 - On the command line: perl misc/bin/connexion_import_daemon.pl -c /etc/koha/sites/kohadev/connexion.cnf 7 - In another terminal: cat bug_33418.test | nc -v localhost 8888 8 - Successful request 9 - Wait 10 seconds (more than 8 anyways) 10 - Repeat 7 11 - Unsuccessful request - Invalid CSRF token 12 - Ctrl+C to stop the connexion daemon 13 - Apply patch 14 - repeat 6 15 - repeat 7, success 16 - Wait more than 8 seconds 17 - repeat 7, success! 18 - repeat again until you are satisfied 19 - Sign off! -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38382 --- Comment #2 from Nick Clemens (kidclamp) <nick@bywatersolutions.com> --- Created attachment 174097 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=174097&action=edit Sample record for import -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38382 Brendan Lawlor <blawlor@clamsnet.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #174096|0 |1 is obsolete| | --- Comment #3 from Brendan Lawlor <blawlor@clamsnet.org> --- Created attachment 174098 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=174098&action=edit Bug 38382: Fresh connection when connexion CSRF token expires This patch simply generates a new user agent when reauthenticating when the CSRF token for the session has expired. To test: 1 - Edit Koha/Token.pm, line 275 from: { MaxAge => $params->{MaxAge} // ( CSRF_EXPIRY_HOURS * 3600 ) }, to: { MaxAge => $params->{MaxAge} // ( CSRF_EXPIRY_HOURS ) }, 2 - This will make your CSRF tokens expire after 8 seconds 3 - vim /etc/koha/sites/kohadev/connexion.cnf 4 - Set content: host: port: 8888 koha:http://localhost:8081 log:/var/log/koha/kohadev/connexion.log match:ISBN user:kohauser password:kohapass overlay_action:replace nomatch_action:create_new item_action:always_add import_mode:direct framework:BKS overlay_framework: debug:1 5 - Save the sample file from this bug into your kohaclone (or copy and paste into a file your koha test site can reach) 6 - On the command line: perl misc/bin/connexion_import_daemon.pl -c /etc/koha/sites/kohadev/connexion.cnf 7 - In another terminal: cat bug_33418.test | nc -v localhost 8888 8 - Successful request 9 - Wait 10 seconds (more than 8 anyways) 10 - Repeat 7 11 - Unsuccessful request - Invalid CSRF token 12 - Ctrl+C to stop the connexion daemon 13 - Apply patch 14 - repeat 6 15 - repeat 7, success 16 - Wait more than 8 seconds 17 - repeat 7, success! 18 - repeat again until you are satisfied 19 - Sign off! Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38382 --- Comment #5 from Brendan Lawlor <blawlor@clamsnet.org> --- When starting and stopping the daemon sometimes I'd get a port in use error and this command came in handy: sudo fuser -k 8888/tcp Also When I followed the test plan for Bug 37543 I saw the success message showing HASH(#) instead of the bib number as described in bug 38230 But when I followed this test plan the response correctly displayed the bib number. So I guess that issue seems to be replated to config since I was sending the same requests when I was testing. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38382 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |m.de.rooy@rijksmuseum.nl Status|Signed Off |Failed QA --- Comment #6 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- WARN misc/bin/connexion_import_daemon.pl WARN tidiness The file is less tidy than before (bad/messy lines before: 0, now: 3) -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38382 Nick Clemens (kidclamp) <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #174098|0 |1 is obsolete| | --- Comment #7 from Nick Clemens (kidclamp) <nick@bywatersolutions.com> --- Created attachment 175250 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=175250&action=edit Bug 38382: Fresh connection when connexion CSRF token expires This patch simply generates a new user agent when reauthenticating when the CSRF token for the session has expired. To test: 1 - Edit Koha/Token.pm, line 275 from: { MaxAge => $params->{MaxAge} // ( CSRF_EXPIRY_HOURS * 3600 ) }, to: { MaxAge => $params->{MaxAge} // ( CSRF_EXPIRY_HOURS ) }, 2 - This will make your CSRF tokens expire after 8 seconds 3 - vim /etc/koha/sites/kohadev/connexion.cnf 4 - Set content: host: port: 8888 koha:http://localhost:8081 log:/var/log/koha/kohadev/connexion.log match:ISBN user:kohauser password:kohapass overlay_action:replace nomatch_action:create_new item_action:always_add import_mode:direct framework:BKS overlay_framework: debug:1 5 - Save the sample file from this bug into your kohaclone (or copy and paste into a file your koha test site can reach) 6 - On the command line: perl misc/bin/connexion_import_daemon.pl -c /etc/koha/sites/kohadev/connexion.cnf 7 - In another terminal: cat bug_33418.test | nc -v localhost 8888 8 - Successful request 9 - Wait 10 seconds (more than 8 anyways) 10 - Repeat 7 11 - Unsuccessful request - Invalid CSRF token 12 - Ctrl+C to stop the connexion daemon 13 - Apply patch 14 - repeat 6 15 - repeat 7, success 16 - Wait more than 8 seconds 17 - repeat 7, success! 18 - repeat again until you are satisfied 19 - Sign off! WNC amended and tidied Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38382 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #175250|0 |1 is obsolete| | --- Comment #8 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 175444 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=175444&action=edit Bug 38382: Fresh connection when connexion CSRF token expires This patch simply generates a new user agent when reauthenticating when the CSRF token for the session has expired. To test: 1 - Edit Koha/Token.pm, line 275 from: { MaxAge => $params->{MaxAge} // ( CSRF_EXPIRY_HOURS * 3600 ) }, to: { MaxAge => $params->{MaxAge} // ( CSRF_EXPIRY_HOURS ) }, 2 - This will make your CSRF tokens expire after 8 seconds 3 - vim /etc/koha/sites/kohadev/connexion.cnf 4 - Set content: host: port: 8888 koha:http://localhost:8081 log:/var/log/koha/kohadev/connexion.log match:ISBN user:kohauser password:kohapass overlay_action:replace nomatch_action:create_new item_action:always_add import_mode:direct framework:BKS overlay_framework: debug:1 5 - Save the sample file from this bug into your kohaclone (or copy and paste into a file your koha test site can reach) 6 - On the command line: perl misc/bin/connexion_import_daemon.pl -c /etc/koha/sites/kohadev/connexion.cnf 7 - In another terminal: cat bug_33418.test | nc -v localhost 8888 8 - Successful request 9 - Wait 10 seconds (more than 8 anyways) 10 - Repeat 7 11 - Unsuccessful request - Invalid CSRF token 12 - Ctrl+C to stop the connexion daemon 13 - Apply patch 14 - repeat 6 15 - repeat 7, success 16 - Wait more than 8 seconds 17 - repeat 7, success! 18 - repeat again until you are satisfied 19 - Sign off! WNC amended and tidied Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38382 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to main Version(s)| |25.05.00 released in| | -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38382 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Text to go in the| |This fixes the OCLC release notes| |Connexion import daemon | |(misc/bin/connexion_import_ | |daemon.pl) - the connection | |was failing after the CSRF | |token expired (after 8 | |hours). It now generates a | |new user agent when | |reauthenticating when the | |CSRF token for the session | |has expired. (This is | |related to the CSRF changes | |added in Koha 24.05 to | |improve form security.) CC| |david@davidnind.com Depends on| |36192 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36192 [Bug 36192] [OMNIBUS] CSRF Protection for Koha -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38382 --- Comment #10 from Paul Derscheid <paul.derscheid@lmscloud.de> --- Nice work everyone! Pushed to 24.11.x for 24.11.01 -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38382 Alex Buckley <alexbuckley@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |alexbuckley@catalyst.net.nz --- Comment #11 from Alex Buckley <alexbuckley@catalyst.net.nz> --- Hi, 1) Can you please give us a more detailed test plan? 2) Are we supposed to make the /etc/koha/sites/kohadev/connexion.cnf file? 3) We noticed that there are some strange characters in the sample record for import file ( https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=174097 ), which is giving us the following output in step 6: kohadev-koha@kohadevbox:koha((v24.05.06))$ perl misc/bin/connexion_import_daemon.pl -c /etc/koha/sites/kohadev/connexion.cnf no mapping found for [0x90] at position 0 in ��96475 g0=ASCII_DEFAULT g1=EXTENDED_LATIN at /usr/share/perl5/MARC/Charset.pm line 308. no mapping found for [0x90] at position 2 in 8␞2024022215392 g0=ASCII_DEFAULT g1=EXTENDED_LATIN at /usr/share/perl5/MARC/Charset.pm line 308. no mapping found for [0x90] at position 4 in 4.0␞981015s1948 enk 000 g0=ASCII_DEFAULT g1=EXTENDED_LATIN at /usr/share/perl5/MARC/Charset.pm line 308. 4) For step 8 we get the following, is this to be expected? kohadev-koha@kohadevbox:koha((v24.05.06))$ cat bug_33418.test | nc -v localhost 8888 nc: connect to localhost (::1) port 8888 (tcp) failed: Connection refused Connection to localhost (127.0.0.1) 8888 port [tcp/*] succeeded! Unsuccessful requestkohadev-koha@kohadevbox:koha((v24.05.06))$ -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38382 --- Comment #12 from Nick Clemens (kidclamp) <nick@bywatersolutions.com> --- (In reply to Alex Buckley from comment #11)

Hi,

1) Can you please give us a more detailed test plan? Which parts are unclear? I should have mentioned creating a user with kohauser/kohapass as the credentials, or use the credentials for an existing account with the correct permissions

2) Are we supposed to make the /etc/koha/sites/kohadev/connexion.cnf file? Yes, create this file if it doesn't exist

3) We noticed that there are some strange characters in the sample record for import file ( https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=174097 ), which is giving us the following output in step 6:

kohadev-koha@kohadevbox:koha((v24.05.06))$ perl misc/bin/connexion_import_daemon.pl -c /etc/koha/sites/kohadev/connexion.cnf no mapping found for [0x90] at position 0 in ��96475 g0=ASCII_DEFAULT g1=EXTENDED_LATIN at /usr/share/perl5/MARC/Charset.pm line 308. no mapping found for [0x90] at position 2 in 8␞2024022215392 g0=ASCII_DEFAULT g1=EXTENDED_LATIN at /usr/share/perl5/MARC/Charset.pm line 308. no mapping found for [0x90] at position 4 in 4.0␞981015s1948 enk 000 g0=ASCII_DEFAULT g1=EXTENDED_LATIN at /usr/share/perl5/MARC/Charset.pm line 308.

I think this may be from copying/pasting or the way it was downloaded - you can simply export a single record from your koha in marc format and add: U8kohauserP8kohapass at the start - connection expects those two fields then parses the rest as marc - you will need to create a user with those credentials and permissions to edit the catalogue - or substitute your own credentials

4) For step 8 we get the following, is this to be expected?

kohadev-koha@kohadevbox:koha((v24.05.06))$ cat bug_33418.test | nc -v localhost 8888 nc: connect to localhost (::1) port 8888 (tcp) failed: Connection refused Connection to localhost (127.0.0.1) 8888 port [tcp/*] succeeded! Unsuccessful requestkohadev-koha@kohadevbox:koha((v24.05.06))$

No, the request shoudl be successful, but perhaps the user wasn't created? I get: kohadev-koha@kohadevbox:koha(main)$ cat bug_33418.test | nc -v localhost 8888 nc: connect to localhost (::1) port 8888 (tcp) failed: Connection refused Connection to localhost (127.0.0.1) 8888 port [tcp/*] succeeded! Success. Batch number 2 - biblio record number 439 overlaid by import. http://kohadev-intra.myDNSname.org:8081/cgi-bin/koha/catalogue/detail.pl?bib... -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38382 Alex Buckley <alexbuckley@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |Pushed to oldstable Version(s)|25.05.00,24.11.02 |25.05.00,24.11.02,24.05.08 released in| | --- Comment #14 from Alex Buckley <alexbuckley@catalyst.net.nz> --- Nice work everyone! Pushed to 24.05.x for 24.05.08 -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38382 Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |caroline.cyr-la-rose@inlibr | |o.com Status|Needs documenting |RESOLVED Resolution|--- |FIXED --- Comment #16 from Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com> --- Bug fix, nothing to add/edit in the manual -- You are receiving this mail because: You are watching all bug changes.